Active Directory Domain Services – Setup Windows Server Conceptual

🛠️ Step-by-Step: Setting Up an Active Directory Domain Services (AD DS) Server

---

✅ Prerequisites Before Installing AD DS

• ✔ Windows Server (2016 / 2019 / 2022 / 2025)
• ✔ Static IP address configured
• ✔ Updated system & security patches
• ✔ Correct system time & timezone
• ✔ Sufficient disk space (NTDS & SYSVOL)

---

⬇️ How to Download Windows Server ISO (2016 / 2019 / 2022 / 2025)

Before installing Active Directory Domain Services, you must obtain a legitimate Windows Server ISO image. Microsoft provides official evaluation ISOs suitable for learning, lab environments, and enterprise testing.

🅾️ Option 1: Download via Microsoft Evaluation Center

• Visit Microsoft Evaluation Center:
  https://www.microsoft.com/evalcenter
• Select Windows Server
• Choose version: 2016 / 2019 / 2022
• Select ISO download
• Fill in required evaluation details

---

🅾️ Option 2: Direct Official ISO Download Links

• Windows Server 2016
  https://www.microsoft.com/en-us/evalcenter/download-windows-server-2016
• Windows Server 2019
  https://www.microsoft.com/en-us/evalcenter/download-windows-server-2019
• Windows Server 2022
  https://www.microsoft.com/en-us/evalcenter/download-windows-server-2022
• Windows Server 2025
  https://www.microsoft.com/en-us/evalcenter/download-windows-server-2025

📦 Recommended Editions for AD DS Labs

• ✔ Windows Server Standard (Desktop Experience)
• ✔ Windows Server Datacenter (Desktop Experience)

---

🖥️ Installing Windows Server Using VMware (Complete Lab Setup)

VMware allows you to safely deploy Active Directory inside an isolated lab environment without affecting your physical system.

🔹 Step 1: Install VMware Workstation

• ✔ Download VMware Workstation Player or Pro
• ✔ Supported on Windows & Linux
• ✔ Install with default settings

---

🔹 Step 2: Create New Virtual Machine

• Open VMware Workstation
• Click Create a New Virtual Machine
• Select Typical (Recommended) → Next
• Choose I will install the operating system later
• Guest OS: Microsoft Windows
• Version: Windows Server 2016
• VM Name: WIN2016
• Disk Size: 60 GB
• Select Split disk into multiple files
• Click Finish

---

🔹 Step 2.1: Virtual Hardware Configuration (Recommended)

Component	Recommended Value
CPU	2 vCPUs (Minimum)
Memory	4–8 GB RAM
Disk	80–100 GB (Single disk)
Network	NAT (Default) or Host-Only

---

🔹 Step 3: Attach Windows Server ISO

• Select VM → Edit virtual machine settings
• Click CD/DVD (SATA)
• Enable Connect at power on
• Select Use ISO image file
• Browse & select Windows Server 2016 ISO
• Click OK

---

🔹 Step 4: Start Windows Installation

• Click Power on this virtual machine
• Windows Setup loads automatically
• Select Language, Time & Keyboard
• Click Install Now

---

🔹 Step 5: Select Windows Server Edition

• Select Windows Server 2016 Standard Evaluation (Desktop Experience)
• Desktop Experience provides GUI required for AD labs
• Click Next

---

🔹 Step 6: Select Installation Type

• Choose Custom: Install Windows only (advanced)
• Click Next

---

🔹 Step 7: Disk Selection

• Select Drive 0 Unallocated Space
• Click Next

---

🔹 Step 8: Configure Administrator Password

• System installs & reboots automatically
• Enter strong Administrator password
• Re-enter password → Finish

---

🔹 Step 9: Login to Server

• Click inside VM window
• VM → Send Ctrl + Alt + Del
• Login as Administrator

---

🔹 Step 10: Server Manager Dashboard

• Server Manager opens automatically
• Click Add roles and features

---

🔹 Step 11: Add Roles & Features Wizard

• Review Before you begin
• Click Next
• Select Role-based or feature-based installation
• Click Next
• Select Local Server
• Click Next

---

🔹 Step 11.1: Take Snapshot Before AD DS Installation

• Power off the virtual machine
• Create a VMware snapshot
• Name it Pre-AD DS Install
• Ensures safe rollback if promotion fails

---

🔹 Step 12: Install Active Directory Domain Services (AD DS)

• Check Active Directory Domain Services
• Click Add Features
• Click Next through Features
• Click Install

---

🔹 Step 13: Promote to Domain Controller

• Click Promote this server to a domain controller
• Select Add a new forest
• Root domain name: NotesTime.local
• Forest & Domain level: Windows Server 2016
• Ensure DNS Server & Global Catalog checked
• Enter DSRM password
• Leave DNS delegation unchecked
• NetBIOS name: NOTESTIME
• Keep default database & SYSVOL paths
• Run Prerequisites Check
• Click Install

---

🔹 Step 14: Automatic Reboot

• Server displays You're about to be signed out
• System reboots automatically
• Domain Controller promotion completes

---

🔹 Step 15: Login as Domain Administrator

• Press Ctrl + Alt + Del
• Login as NOTESTIME\Administrator

---

🔹 Step 16: Verify Active Directory Tools

• Open Start Menu
• Navigate to Windows Administrative Tools
• Confirm availability of:
• ✔ Active Directory Users and Computers
• ✔ Active Directory Domains and Trusts
• ✔ Active Directory Sites and Services
• ✔ DNS Manager

---

🏗️ Managing Active Directory Objects (OU, Users, Groups & Computers)

Active Directory organizes resources using logical objects. Understanding how to create and manage these objects is essential for administration, security, and Group Policy enforcement.

📂 Organizational Unit (OU)

An Organizational Unit (OU) is a container used to organize users, groups, computers, and other OUs within a domain. OUs are primarily used for delegation and Group Policy application.

• ✔ Logical organization of AD objects
• ✔ Enables Group Policy targeting
• ✔ Supports administrative delegation

🛠️ How to Create an OU

1. Open Active Directory Users and Computers
2. Right-click the domain (NotesTime.local)
3. Select New → Organizational Unit
4. Enter OU name (e.g. IT, HR)
5. Click OK

👤 User Object

A User object represents an individual identity used to log in, access resources, and receive permissions within the domain.

• ✔ Used for authentication
• ✔ Assigned permissions via groups
• ✔ Controlled by Group Policies

🛠️ How to Create a User

1. Open Active Directory Users and Computers
2. Navigate to desired OU
3. Right-click → New → User
4. Enter name, username (e.g. jdoe)
5. Set password and account options
6. Click Finish

🗑️ How to Delete a User

Deleting a user permanently removes the account from Active Directory. This action should be performed carefully, especially in production environments.

• ⚠️ Ensure the user account is no longer required
• ⚠️ Disable the account first (recommended best practice)
• ⚠️ Confirm no critical services depend on the account

🛠️ Step-by-Step: Delete a User Account

1. Open Active Directory Users and Computers
2. Navigate to the appropriate Organizational Unit (OU)
3. Locate the user account (e.g. jdoe)
4. Right-click the user → Select Delete
5. Click Yes to confirm deletion

🔐 Recommended Enterprise Practice

• ✔ Step 1: Disable the account
• ✔ Step 2: Remove from all security groups
• ✔ Step 3: Wait 30–90 days (grace period)
• ✔ Step 4: Then permanently delete

🏢 Managing Multiple Users in an OU & Assigning an Administrator

An Organizational Unit (OU) can contain multiple user accounts. You can assign administrative privileges to a specific user either at the domain level or only for a specific OU.

---

👥 Example Scenario

• OU Name: IT
• Users inside OU: Rahul, Priya, Amit
• Requirement: Assign Rahul as IT Administrator

---

🔹 Method 1: Assign Domain Administrator (Full Control – Not Recommended for OU Only)

1. Open Active Directory Users and Computers
2. Navigate to Users container
3. Double-click Domain Admins group
4. Click Add
5. Add user (e.g. Rahul)
6. Click OK

---

🔹 Method 2: Delegate Control on Specific OU (Recommended Enterprise Method)

This method gives administrative control only over a specific OU, not the entire domain.

1. Right-click the OU (e.g. IT)
2. Select Delegate Control
3. Click Next
4. Click Add → Select user (e.g. Rahul)
5. Click Next
6. Choose task:
   • Create, delete, and manage user accounts
   • Reset user passwords
   • Modify group membership
7. Click Next → Finish

---

🔐 Enterprise Best Practice

• ✔ Never assign users directly to Domain Admins unless necessary
• ✔ Use OU-level delegation instead
• ✔ Follow Least Privilege Principle
• ✔ Use separate admin accounts (e.g. rahul.admin)

👥 Group Object

A Group object is used to assign permissions to multiple users or computers at once. This simplifies access management.

• ✔ Centralized permission management
• ✔ Users added to groups inherit access
• ✔ Reduces administrative overhead

🛠️ How to Create a Group

1. Right-click desired OU
2. Select New → Group
3. Enter group name (e.g. IT-Admins)
4. Group scope: Global
5. Group type: Security
6. Click OK

💻 Computer Object

A Computer object represents a machine that is joined to the Active Directory domain.

• ✔ Represents domain-joined systems
• ✔ Receives computer-based Group Policies
• ✔ Used for access control and auditing

🛠️ How to Create a Computer Object

1. Open Active Directory Users and Computers
2. Right-click desired OU
3. Select New → Computer
4. Enter computer name (e.g. WIN10-CLIENT)
5. Click OK

✅ Best Practices for AD Object Management

• ✔ Use OUs instead of default containers
• ✔ Separate users, computers, and servers
• ✔ Use groups for permissions (AGDLP model)
• ✔ Apply GPOs at OU level

---

🛡️ How to Create a Group Policy (GPO) – Step by Step

Group Policy allows administrators to centrally manage user and computer settings across the domain. GPOs are usually linked to an Organizational Unit (OU).

---

🔹 Example Scenario

• OU Name: IT
• Requirement: Disable Control Panel for IT users

---

🛠️ Step 1: Open Group Policy Management

1. Click Start
2. Open Server Manager
3. Go to Tools
4. Select Group Policy Management

---

🛠️ Step 2: Create New GPO

1. Expand your domain (e.g. NotesTime.local)
2. Right-click the target OU (e.g. IT)
3. Select Create a GPO in this domain, and Link it here
4. Enter GPO Name (e.g. IT-ControlPanel-Restriction)
5. Click OK

---

🛠️ Step 3: Edit the GPO

1. Right-click the newly created GPO
2. Select Edit
3. Navigate to:
   User Configuration → Administrative Templates → Control Panel
4. Double-click Prohibit access to Control Panel and PC settings
5. Select Enabled
6. Click Apply → OK

---

🛠️ Step 4: Apply & Verify Policy

1. Login to a user inside IT OU
2. Open Command Prompt
3. Run command: gpupdate /force
4. Test if Control Panel access is restricted

---

🔐 Enterprise Best Practices for GPO

• ✔ Never edit Default Domain Policy unless necessary
• ✔ Use descriptive naming for GPOs
• ✔ Test GPOs in lab before production
• ✔ Avoid linking too many GPOs to one OU
• ✔ Document every policy change

💻 How to Add (Join) a Computer to Active Directory – Real-World Enterprise Steps

In real enterprise environments, computers are joined to the domain to enable centralized authentication, Group Policy enforcement, security control, and auditing.

---

🔹 Real-World Scenario

• Domain Name: NotesTime.local
• Client OS: Windows 10 / Windows 11
• OU Target: Workstations
• IT Admin performing domain join

---

🛠️ Step 1: Pre-Join Requirements (Very Important)

• ✔ Client must use Domain Controller DNS IP
• ✔ Network connectivity to Domain Controller
• ✔ Correct date & time (Kerberos requirement)
• ✔ Domain credentials (Domain Admin or delegated account)

---

🛠️ Step 2: Configure DNS on Client Machine

1. Open Network Settings
2. Go to Adapter Options
3. Right-click → Properties
4. Select Internet Protocol Version 4 (TCP/IPv4)
5. Set Preferred DNS to Domain Controller IP (e.g. 192.168.1.10)
6. Click OK

---

🛠️ Step 3: Join Computer to Domain

1. Right-click This PC → Select Properties
2. Click Advanced system settings
3. Under Computer Name tab → Click Change
4. Select Domain
5. Enter domain name: NotesTime.local
6. Click OK
7. Enter Domain Admin credentials
8. Click OK

---

🛠️ Step 4: Restart Computer

• System will prompt for restart
• Click Restart Now

---

🛠️ Step 5: Login Using Domain Account

1. Press Ctrl + Alt + Del
2. Click Other User
3. Login using: NOTESTIME\username

---

🛠️ Step 6: Move Computer to Correct OU (Important in Enterprise)

1. Open Active Directory Users and Computers
2. Locate computer in Computers container
3. Right-click → Move
4. Select appropriate OU (e.g. Workstations)
5. Click OK

---

🔐 Real-World Enterprise Best Practices

• ✔ Use delegated accounts for domain join
• ✔ Use naming standards (e.g. HR-WS-001)
• ✔ Join computers directly into correct OU (via PowerShell or imaging tools)
• ✔ Apply baseline security GPO immediately
• ✔ Monitor domain join events in Event Viewer

🧪 AD Lab Best Practices (Professional)

• ✔ Windows Server Installed
• ✔ Active Directory Domain Services Installed
• ✔ Domain Controller Promoted
• ✔ DNS Configured Automatically
• ✔ AD Administrative Tools Available

---

🏁 Final Enterprise Takeaways

• ✔ AD DS setup defines enterprise security posture
• ✔ DNS, Kerberos, and time sync are critical
• ✔ Misconfiguration is the primary risk
• ✔ Hardening must follow installation immediately
• ✔ Continuous monitoring is mandatory